CHAPTER 11 NETWORK ADDRESS TRANSLATION UNTUK IPV4 · IPV4 PRIVATE ADDRESS SPACE •IPv4 address...

CHAPTER 11

NETWORK ADDRESS TRANSLATION UNTUK IPV4

Routing & Switching

CHAPTER 1111.1 NAT Operation

11.2 Configuring NAT

11.3 Troubleshooting NAT

11.4 Summary

CHAPTER 11: OBJECTIVES• Describe NAT characteristics.

• Describe the benefits and drawbacks of NAT.

• Configure static NAT using the CLI.

• Configure dynamic NAT using the CLI.

• Configure PAT using the CLI.

• Configure port forwarding using the CLI.

• Configure NAT64.

• Use show commands to verify NAT operation.

11.1 NAT OPERATION

NAT CHARACTERISTICS

IPV4 PRIVATE ADDRESS SPACE

• IPv4 address space is not big enough to uniquely address all the devices that must be connected to the Internet.

• Network private addresses are described in RFC 1918 and are to designed to be used within an organization or site only.

• Private addresses are not routed by Internet routers while public addresses are.

• Private addresses can alleviate IPv4 scarcity, but because they aren’t routed by Internet devices, they first need to be translated.

• NAT is process used to perform such translation.

APA ITU NAT?

NAT CHARACTERISTICS

NAT

• NAT adalah metode translasi IP Private menjadi IP Public. Bertujuan agar dapat berkomunikasi dengan internet maka harus terintegrasi dengan IP Public

APA TUJUAN NAT?

• Mengurangi keterbatasan IPv4

• Menyembunyikan skema network internal

TERMINOLOGI NAT

• Inside Local Address : source address sebelum translasi(IP Private)

• Outside Local Address : destination address sebelumtranslasi (IP Private)

• Inside Global Address : inside host setelah translasi (IP Public)

• Outside Global Address : outside destionation host setelah translasi (IP Public)

NAT CHARACTERISTICS

IPV4 PRIVATE ADDRESS SPACE

APA ITU IP PRIVATE?

• IP yang digunakan oleh organisasi secara internal dantidak dapat dirutekan di internet.

• Perusahaan kecil biasanya mendapatkan IP Public dariISP

• ISP Mendapatkan Alokasi IP Public dari IANA (internasional Assigned Numbers Authority)

• Device yang dapat melakukan translasi biasanyafirewall,router,server

IP PRIVATE

IP PRIVATE

Class Range

A 10.0.0.0 – 10.255.255.255

B 172.16.0.0 -172.31.255.255

C 192.168.0.0 – 192.168.255.255

CARI HIERARKI ISP DI INDONESIA?

KEUNTUNGAN NAT

• Menghemat alamat IP secara legal

• Mengurangi overlap pengalamatan

• Meningkatkan fleksibilitas ketika berkomunikasi keinternet

• Mengurangi penomoran kembali jika terjadi perubahanjaringan

KERUGIAN NAT

• Terdapat delay pada proses switching

• Tidak dapat melakukan trace end-to-end IP

• Terdapat beberapa aplikasi yang tidak berfungsi ketikaimplementasi NAT

TIPE NAT

• NAT Static

• NAT Dynamic

• PAT (Port Address Translation)

NAT STATIC

• Termasuk jenis one-to-one NAT, satu IP private ditranslatemenjadi satu IP public.

• Ingat, untuk NAT static tiap host menggunakan IP public sendiri

• Bisa inisiasi komunikasi dari jaringan outside global

KONFIGURASI NAT STATIC

TABEL IP

Private IP Public IP

192.168.1.1 12.12.12.11

192.168.1.2 12.12.12.22

192.168.1.3 12.12.12.33

TABEL NAT R1

TABEL NAT R2

Private IP Public IP

192.168.2.1 12.12.12.44

192.168.2.2 12.12.12.55

192.168.2.3 12.12.12.66

LANGKAH-LANGKAH

• Tentukan interface NAT inside

• Tentukan interface NAT outside

• Buat translasi NAT dari source Private IP ke destination Public IP

NAT DYNAMIC

• Termasuk tipe many to many NAT, IP private dalamjumlah banyak kemudian ditranslate menjadi IP public yang banyak juga dengan menyediakan sebuah pool IP public

• Tidak perlu melakukan translate satu per satu, cukupsediakan IP Public sesuai dengan jumlah user yang akanterkoneksi ke internet

TABEL IP

Private IP (ACL 1) Public IP (POOLR1)

192.168.1.0/24 12.12.12.11-12.12.12.20

POOL NAT RI

POOL NAT R2


192.168.2.0/24 12.12.12.21-12.12.12.30

NAT DYNAMIC OVERLOAD (PAT)

• Tipe nat paling popular

• Termasuk tipe many to one NAT

• Dengan menyediakan satu IP public dapat mentranslasiIp private yang banyak denga menggunakanpembeda port.

• Disebut juga sebagai NAT dynamic overload , Port Address Translation

TABEL IP


192.168.1.0/24 12.12.12.11

POOL NAT RI

POOL NAT R2


192.168.2.0/24 12.12.12.22

NAT CHARACTERISTICS

WHAT IS NAT? (CONT.)

NAT CHARACTERISTICS

NAT TERMINOLOGY• Inside network is the set of

devices using private addresses

• Outside network refers to all other networks

• NAT includes four types of addresses:

• Inside local address

• Inside global address

• Outside local address

• Outside global address

NAT CHARACTERISTICS

NAT TERMINOLOGY (CONT.)

TYPES OF NAT

STATIC NAT

• Static NAT uses a one-to-one mapping of local and global addresses.

• These mappings are configured by the network administrator and remain constant.

• Static NAT is particularly useful when servers hosted in the inside network must be accessible from the outside network.

• A network administrator can SSH to a server in the inside network by pointing the SSH client to the proper inside global address.

TYPES OF NAT

STATIC NAT (CONT.)

TYPES OF NAT

DYNAMIC NAT

CONFIGURATION

DYNAMIC NAT

• Termasuk many-to-many NAT , dimana IP Private jumlahbanyak kemudian ditranslasikan menjadi IP public dalam jumlah banyak juga dengan menyediakansebuah pool IP public

• Tidak perlu memerlukan translate satu per satu, cukupsediakan IP public sejumlah user yang terkoneksi keinternet.

POOL NAT R1 DAN R2

Private IP (ACL 1) Public IP (Pool R1)

192.168.1.0/24 12.12.12.11-12.12.12.20


192.168.2.0/24 12.12.12.21-12.12.12.30

LANGKAH-LANGKAH



• Tentukan permit ACL Private Network

• Tentukan pool Public IP

• Buat translasi NAT dari source ACL ke destination pool Public IP

TYPES OF NAT

DYNAMIC NAT

• Dynamic NAT uses a pool of public addresses and assigns them on a first-come, first-served basis.

• When an inside device requests access to an outside network, dynamic NAT assigns an available public IPv4 address from the pool.

• Dynamic NAT requires that enough public addresses are available to satisfy the total number of simultaneous user sessions.

PAT

CONFIGURATION

NAT DYNAMIC OVERLOAD (PAT)

• Tipe NAT yang paling populer

• Termasuk tipe many-to-one NAT

• Dengan menyediakan satu IP public dapatmentranslate IP private yang banyak denganmenggunakan pembeda yaitu port

• Disebut juga sebagai NAT Dynamic Overload, Port Address Translation (PAT), atau NAT Overload

POOL NAT R1 DAN R2


192.168.1.0/24 12.12.12.11


192.168.2.0/24 12.12.12.22

LANGKAH-LANGKAH



• Tentukan permit ACL Private Network

• Tentukan pool Public IP (terdiri dari single IP Public)

• Buat translasi NAT dari source ACL ke destination pool Public IP

TYPES OF NAT

DYNAMIC NAT

• Dynamic NAT uses a pool of public addresses and assigns them on a first-come, first-served basis.

• When an inside device requests access to an outside network, dynamic NAT assigns an available public IPv4 address from the pool.

• Dynamic NAT requires that enough public addresses are available to satisfy the total number of simultaneous user sessions.

TYPES OF NAT

DYNAMIC NAT (CONT.)

TYPES OF NAT

PORT ADDRESS TRANSLATION

• Port Address Translation (PAT) maps multiple private IPv4 addresses to a single public IPv4 address or a few addresses.

• PAT uses the pair source port and source IP address to keep track of what traffic belongs to what internal client.

• PAT is also known as NAT overload.

• By also using the port number, PAT forwards the response packets to the correct internal device.

• The PAT process also validates that the incoming packets were requested, thus adding a degree of security to the session.

TYPES OF NAT

COMPARING NAT AND PAT

• NAT translates IPv4 addresses on a 1:1 basis between private IPv4 addresses and public IPv4 addresses.

• PAT modifies both the address and the port number.

• NAT forwards incoming packets to their inside destination by referring to the incoming source IPv4 address provided by the host on the public network.

• With PAT, there is generally only one or a very few publicly exposed IPv4 addresses.

• PAT is able to translate protocols that do not use port numbers, such as ICMP; each one of these protocols is supported differently by PAT.

BENEFITS OF NAT

BENEFITS OF NAT

• Conserves the legally registered addressing scheme

• Increases the flexibility of connections to the public network

• Provides consistency for internal network addressing schemes

• Provides network security

BENEFITS OF NAT

DISADVANTAGES OF NAT

• Performance is degraded

• End-to-end functionality is degraded

• End-to-end IP traceability is lost

• Tunneling is more complicated

• Initiating TCP connections can be disrupted

8.2 CONFIGURING NAT

CONFIGURING STATIC NAT


There are two basic tasks to perform when configuring static NAT translations:

• Create the mapping between the inside local and outside local addresses.

• Define which interfaces belong to the inside network and which belong to the outside network.


ANALYZING STATIC NAT


VERIFYING STATIC NAT


VERIFYING STATIC NAT (CONT.)

CONFIGURING DYNAMIC NAT

DYNAMIC NAT OPERATION

• The pool of public IPv4 addresses (inside global address pool) is available to any device on the inside network on a first-come, first-served basis.

• With dynamic NAT, a single inside address is translated to a single outside address.

• The pool must be large enough to accommodate all inside devices.

• A device is unable to communicate to any external networks if no addresses are available in the pool.


ANALYZING DYNAMIC NAT


VERIFYING DYNAMIC NAT

CONFIGURING PAT

CONFIGURING PAT: ADDRESS POOL

CONFIGURING PAT

CONFIGURING PAT: SINGLE ADDRESS

CONFIGURING PAT

ANALYZING PAT

CONFIGURING PAT

VERIFYING PAT TRANSLATIONS

PORT FORWARDING

PORT FORWARDING

• Port forwarding is the act of forwarding a network port from one network node to another.

• A packet sent to the public IP address and port of a router can be forwarded to a private IP address and port in inside network.

• Port forwarding is helpful in situations where servers have private addresses, not reachable from the outside networks.

PORT FORWARDING

SOHO EXAMPLE

PORT FORWARDING

CONFIGURING PORT FORWARDING WITH IOS

In IOS, Port forwarding is essentially a static NAT translation with a specified TCP or UDP port number.

CONFIGURING NAT AND IPV6

NAT FOR IPV6?• NAT is a workaround for IPv4 address scarcity.

• IPv6 with a 128-bit address provides 340 undecillion addresses.

• Address space is not an issue for IPv6.

• IPv6 makes IPv4 public-private NAT unnecessary by design; however, IPv6 does implement a form of private addresses, and it is implemented differently than they are for IPv4.


IPV6 UNIQUE LOCAL ADDRESSES

• IPv6 unique local addresses (ULAs) are designed to allow IPv6 communications within a local site.

• ULAs are not meant to provide additional IPv6 address space.

• ULAs have the prefix FC00::/7, which results in a first hextet range of FC00 to FDFF.

• ULAs are also known as local IPv6 addresses (not to be confused with IPv6 link-local addresses).


NAT FOR IPV6• IPv6 also uses NAT, but in a much different context.

• In IPv6, NAT is used to provide transparent communication between IPv6 and IPv4.

• NAT64 is not intended to be a permanent solution; it is meant to be a transition mechanism.

• Network Address Translation-Protocol Translation (NAT-PT) was another NAT-based transition mechanism for IPv6, but is now deprecated by IETF.

• NAT64 is now recommended.


NAT FOR IPV6

8.3 TROUBLESHOOTING NAT


TROUBLESHOOTING NAT: SHOW COMMANDS


TROUBLESHOOTING NAT: DEBUG COMMAND

CHAPTER 11: SUMMARY

This chapter has outlined:

• How NAT is used to help alleviate the depletion of the IPv4 address space.

• NAT conserves public address space and saves considerable administrative overhead in managing adds, moves, and changes.

• NAT for IPv4, including:

• NAT characteristics, terminology, and general operations

• Different types of NAT, including static NAT, dynamic NAT, and NAT with overloading

• Benefits and disadvantages of NAT

• The configuration, verification, and analysis of static NAT, dynamic NAT, and NAT with overloading.

CHAPTER 11: SUMMARY (CONT.)

• How port forwarding can be used to access an internal devices from the Internet.

• Troubleshooting NAT using show and debug commands.

• How NAT for IPv6 is used to translate between IPv6 addresses and IPv4 addresses.

TERIMA KASIH

Thank you very much for your kind attention

CHAPTER 11 NETWORK ADDRESS TRANSLATION UNTUK IPV4 · IPV4 PRIVATE ADDRESS SPACE •IPv4 address...

Documents

Transcript of CHAPTER 11 NETWORK ADDRESS TRANSLATION UNTUK IPV4 · IPV4 PRIVATE ADDRESS SPACE •IPv4 address...